Date: Mon, 8 Aug 2016 17:39:35 +0300 From: Kirill Zaitsev <kzaitsev@...antis.com> To: oss-security@...ts.openwall.com Subject: RCE vulnerability in Openstack Murano using insecure YAML tags (CVE-2016-4972) ============================================================== RCE vulnerability in Openstack Murano using insecure YAML tags ============================================================== :Date: June 23, 2016 :CVE: CVE-2016-4972 Affects ~~~~~~~ - Murano: <=2015.1.1; <=1.0.2; ==2.0.0 - Murano-dashboard: <=2015.1.1; <=1.0.2; ==2.0.0 - Python-muranoclient: <=0.7.2; >=0.8.0<=0.8.4 Description ~~~~~~~~~~~ Kirill Zaitsev from Mirantis reported a vulnerability in OpenStack Murano applications processing. Using extended YAML tags in Murano application YAML files, an attacker can perform a Remote Code Execution attack. Vulnerability has been verified in all currently supported branches. Further examination of code suggest, that it is also present in kilo and juno versions of murano. Patches ~~~~~~~ - https://review.openstack.org/#/c/333444/ (Liberty) - https://review.openstack.org/#/c/333425/ (Liberty) - https://review.openstack.org/#/c/333432/ (Liberty) - https://review.openstack.org/#/c/333443/ (Mitaka) - https://review.openstack.org/#/c/333424/ (Mitaka) - https://review.openstack.org/#/c/333439/ (Mitaka) - https://review.openstack.org/#/c/333423/ (Newton) - https://review.openstack.org/#/c/333440/ (Newton) - https://review.openstack.org/#/c/333428/ (Newton) Credits ~~~~~~~ - Kirill Zaitsev from Mirantis (CVE-2016-4972) References ~~~~~~~~~~ - https://bugs.launchpad.net/python-muranoclient/+bug/1586078 - https://bugs.launchpad.net/murano/+bug/1586079 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4972 Notes ~~~~~ - Fixes for this bug are going to be included in the upcoming releases of murano 1.0.3(liberty), 2.0.1(mitaka), 3.0.0(newton) and python-muranoclient 0.7.3(liberty), 0.8.5(mitaka), 0.9.0(newton) -- Kirill Zaitsev Murano Project Technical Lead Content of type "text/html" skipped Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ